The rapid evolution of botnet attacks poses a critical challenge facing cybersecurity, necessitating the development of intrusion detection models that are both highly accurate and computationally efficient. This paper proposes a heterogeneous radial basis function neural network structure that employs non-uniform RBF kernels to enhance discriminative capability between normal and botnet activities, leveraging flow-level packet length distribution features derived from the CTU-13 dataset, which encompasses 30 distinct botnet types, to ensure comprehensive detection across several botnet behaviors. The model was accurately evaluated across several dimensions, including training stability, robustness to noise, and overall detection accuracy and generalization performance. Experimental results demonstrate that the proposed model achieves a superior accuracy of 97.86%, with an AUC of 0.9968 and a notably low false-positive rate of 0.02. The model effectively mitigates class-imbalance bias, with an average detection rate of 94.62% even for minority botnet classes. Furthermore, inference-time evaluation showed a latency of approximately 1.0118 microseconds, confirming that the model is well-suited for high-speed networks. In addition, robustness analysis under controlled noise injection revealed a smooth degradation in performance, with accuracy remaining at 96%, highlighting the structural resilience of the proposed model and making it a robust solution for detecting modern botnet attacks.
Awad et al. (Tue,) studied this question.